CVE-2026-110628

HighCVSS 8.6

Published: 14/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.

Risk Assessment

An attacker can access internal services and cloud metadata, potentially leading to leakage of sensitive information or further attacks.

Recommendation

Update Kan to a version later than 0.6.0 and set S3_ENDPOINT or restrict the ability to pass arbitrary URLs to fetch().

Other vulnerabilities in Kan

CVE-2026-92802Medium
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.

Original NVD description (English source)

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS